Re: Missing entry com.apple.managed.vpn.shared in provisioning profile

There’s been recent changes in this space; see Network Extension Framework Entitlements for details.

Given that you previously had access to com.apple.managed.vpn.shared, I presume you were granted access to Network Extension special entitlements.  If so, are you generating your profile via the new mechanism (enabling the Network Extensions service on your App ID and generating a normal profile from that) or the old mechanism (adding the Network Extension additional entitlements when you generate your provisioning profile)?

Share and Enjoy
—
Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware
let myEmail = "eskimo" + "1" + "@apple.com"

Hi XWu,

I am having the exact problem. My "old" entitlements that were generated from the template work. However, we want to add another developer to the team and cannot re-generate the provisioning profiles. They are missing the shared keychain access.

Let me know if this gets resolved.

BR,

winc03

Even I'm facing the same issue. Created the entitlements as documented in https://forums.developer.apple.com/thread/67613

com.apple.managed.vpn.shared is missing in newly generated profile and hence I'm not able to read the certificate.

I am also encountering the same issue with missing "com.apple.managed.vpn.shared" keychain access which is blocking network extension development on iOS due to not being able to access the client certificate included in the configuration profile.  Is there an existing support ticket that I can add to raise the priority or should I create a new one?

In the meantime, here is what I observe. Using the "new" network extension entitlement on the AppID I get a provisioning profile without the "com.apple.managed.vpn.shared" keychain access:

<key>Entitlements</key>
<dict>
<key>com.apple.developer.networking.networkextension</key>
<array>
<string>app-proxy-provider</string>
<string>content-filter-provider</string>
<string>packet-tunnel-provider</string>
</array>
<key>keychain-access-groups</key>
<array>
<string>Z7N7QHVWT2.*</string>
</array>
<key>get-task-allow</key>
<true/>
<key>application-identifier</key>
<string>Z7N7QHVWT2.com.vmware.ios-tunnel</string>
<key>com.apple.security.application-groups</key>
<array>
<string>group.com.vmware.ios-tunnel</string>
</array>
<key>com.apple.developer.team-identifier</key>
<string>S2ZMFGQM93</string>
</dict>

And if I use the old method of adding the Network Extension iOS (Dev) entitlement when creating the development provisioning profile I get a profile without the "com.apple.managed.vpn.shared" keychain access but with a "com.apple.developer.networking.Hotspot" entitlement added:

<dict>
<key>keychain-access-groups</key>
<array>
<string>Z7N7QHVWT2.*</string>
</array>
<key>get-task-allow</key>
<true/>
<key>application-identifier</key>
<string>Z7N7QHVWT2.com.vmware.ios-tunnel</string>
<key>com.apple.security.application-groups</key>
<array>
<string>group.com.vmware.ios-tunnel</string>
</array>
<key>com.apple.developer.team-identifier</key>
<string>S2ZMFGQM93</string>
<key>com.apple.developer.networking.networkextension</key>
<array>
<string>packet-tunnel-provider</string>
<string>app-proxy-provider</string>
<string>content-filter-provider</string>
</array>
<key>com.apple.developer.networking.HotspotHelper</key>
<true/>
</dict>

This is close to the previous profile which has both the keychain access and the Hotspot profile:

<dict>
<key>keychain-access-groups</key>
<array>
<string>Z7N7QHVWT2.*</string>
<string>com.apple.managed.vpn.shared</string>
</array>
<key>get-task-allow</key>
<true/>
<key>application-identifier</key>
<string>Z7N7QHVWT2.com.vmware.ios-tunnel</string>
<key>com.apple.security.application-groups</key>
<array>
<string>group.com.vmware.ios-tunnel</string>
</array>
<key>com.apple.developer.team-identifier</key>
<string>S2ZMFGQM93</string>
<key>com.apple.developer.networking.networkextension</key>
<array>
<string>packet-tunnel-provider</string>
<string>app-proxy-provider</string>
<string>content-filter-provider</string>
</array>
<key>com.apple.developer.networking.HotspotHelper</key>
<true/>
</dict>

Hi Eskimo,

We are also seeing this issue.

After creating new Provisioning Profile from apple portal it is missing "com.apple.managed.vpn.shared" keychain sharing key. We tried it without this string in our entitlements but have no ability to access the client certificate in the configuration profile, so it can’t start a VPN.

Do we have a fix or workaround for this?

Thanks

I'm stuck waiting on the same issue. I filed bug report 30155113. Eagerly looking forward to a solution. Thanks Eskimo for keeping us updated!

I just updated my Network Extension Framework Entitlements post with information about how you can get access to the com.apple.managed.vpn.shared keychain access group.  Yay!

I appreciate everyone’s patience here.

Share and Enjoy
—
Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware
let myEmail = "eskimo" + "1" + "@apple.com"

Same issue here. Filed TSI with follow up # 662220389